Attack Trees and Risk Scoring

STRIDE and attack trees solve different problems, and the best threat models use both. STRIDE is breadth-first: it sweeps every component or flow for six generic threat categories, which is exactly what makes it good at not missing anything obvious. An attack tree is depth-first: it starts from one specific, concrete attacker goal — "compromise a user's account," "read another customer's order history," "take the checkout API offline" — and systematically decomposes every distinct way an attacker could achieve *that specific goal*, down to concrete, individually assessable steps.

Bruce Schneier formalized attack trees in a widely cited 1999 paper, describing them as a way to apply the kind of structured, decompositional thinking used in fault-tree analysis (an engineering safety technique) to security. The structure has stayed essentially unchanged since: a root node states the goal, child nodes represent distinct ways to achieve the node above them, and the tree bottoms out in leaf nodes — concrete, no-further-decomposition attack steps you can actually reason about individually.